From secnotif@MICROSOFT.COM Thu Nov 8 23:56:43 2001 From: Microsoft Product Security To: MICROSOFT_SECURITY@ANNOUNCE.MICROSOFT.COM Date: Thu, 8 Nov 2001 18:14:27 -0800 Subject: Microsoft Security Bulletin MS01-055 The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. ******************************** -----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Cookie Data in IE Can Be Exposed or Altered Through Script Injection Date: 08 November 2001 Software: Internet Explorer Impact: Exposure and altering of data in cookies Max Risk: High Bulletin: MS01-055 Microsoft encourages customers to review the Security Bulletin at: http://www.microsoft.com/technet/security/bulletin/MS01-055.asp. - ---------------------------------------------------------------------- Issue: ====== Web sites use cookies as a way to store information on a user's local system. Most often, this information is used for customizing and retaining a site's setting for a user across multiple sessions. By design each site should maintain its own cookies on a user's machine and be able to access only those cookies. A vulnerability exists because it is possible to craft a URL that can allow sites to gain unauthorized access to user's cookies and potentially modify the values contained in them. Because some web sites store sensitive information in a user's cookies, it is also possible that personal information could be exposed. Microsoft is preparing a patch for this issue, but in the meantime customers can protect their systems by disabling active scripting. (The FAQ provides step-by-step instructions for doing this). This will protect against both the web-hosted and the mail-borne variants discussed above. When the patch is complete, Microsoft will re-release this bulletin and provide details on obtaining and using it. Mitigating Factors: ==================== - A user must first be enticed to a malicious web site or to open an HTML e-mail containing the malformed URL. - Users who have applied the Outlook Email Security Update are not affected by the HTML mail exploit of this vulnerability. - Users who have set Outlook Express to use the "Restricted Sites" Zone are not affected by the HTML mail exploit of this vulnerability because the "Restricted Sites" zone sets Active Scripting to disabled. Note that this is the default setting for Outlook Express 6.0. Users of Outlook Express 6.0 should verify that Active Scripting is still disabled in the Restricted Sites Zone. Risk Rating: ============ - Internet systems: High - Intranet systems: High - Client systems: High Patch Availability: =================== - A patch is currently under development. A work-around is available to mitigate this vulnerability. Please read the Security Bulletin at http://www.microsoft.com/technet/security/bulletin/ms01-055.asp for information on obtaining this patch. - --------------------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. -----BEGIN PGP SIGNATURE----- Version: PGP 7.1 iQEVAwUBO+s7240ZSRQxA/UrAQHg8gf6A9I1jKIOsGVNbl7viLQoBWbjC1aCFH8n JtP2vFIB182ioZP0xipj9cCncGggwQeSC96xbN8mxRhCPeKUGq0QNzoqhouZ2Dcr KzPNRDJ7+FmL9uD9m/jtCnxrUGlYtfRWs1xvhurl7IEzepP5TmxD5d5xZO/OXPzM EIW04RrZhR0pSzvfBztOhnLg8Uac9vr0+GKIqStFJNuzExXaHve6ID0/tIK6b+er Bslef6ctE0UJ70IEQ4uSZTAhNgWLJRI9oiFsD0aTFOCaCqxQpscT5AIxCnUL2651 uXQNGIUWGkC45Ybp5fxQBCN80mvJ80uwWiCTp7a2pSlKRSWq/b07uw== =q7Wz -----END PGP SIGNATURE----- ******************************************************************* You have received this e-mail bulletin as a result of your registration to the Microsoft Product Security Notification Service. You may unsubscribe from this e-mail notification service at any time by sending an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM The subject line and message body are not used in processing the request, and can be anything you like. To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp. For more information on the Microsoft Security Notification Service please visit http://www.microsoft.com/technet/security/notify.asp. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.